CVE-2026-87303: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87303 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. A low-privileged local attacker with logon access to the infrastructure can, with required human interaction from another user, cause VirtualBox to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 5.9 (Medium) (Oracle Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as a local, easily exploitable denial-of-service issue (CWE category: Availability impact). Exploitation requires a low-privileged account with local logon access to the host system and human interaction from a person other than the attacker, indicating a social engineering or user-triggered component. The scope is marked as "Changed," meaning a successful attack can impact resources beyond the VirtualBox process itself — potentially affecting guest VMs or other virtualization components. The vulnerability was reported to Oracle by Tristan Madani of Talence Security (Oracle Advisory).

Successful exploitation results in a complete denial of service of Oracle VM VirtualBox — the process can be made to hang or crash repeatedly, disrupting all hosted virtual machines on the affected infrastructure. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The changed scope indicates that the disruption may extend beyond the VirtualBox process to affect dependent or co-located virtualized workloads (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and user interaction, which significantly limits the attack surface (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the October 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox to a version beyond 7.2.16 (the advisory also references 7.2.20 as an affected version in the product listing, so upgrading to the latest patched release is recommended). As a temporary measure, restrict local logon access to systems running VirtualBox to trusted users only, and monitor for unusual VirtualBox process crashes or hangs. Oracle strongly recommends applying Critical Patch Update patches as soon as possible (Oracle Advisory).

The vulnerability was reported to Oracle by Tristan Madani of Talence Security, who also reported CVE-2026-87301 and CVE-2026-87311 in the same advisory. No significant public commentary, media coverage, or notable researcher reactions beyond the standard Oracle CPU disclosure have been identified for this specific CVE (Oracle Advisory).